a5236b3142e898d26bf6f106029a3dafc72960eb4949b1ebb59cac601364fd61 | Triage

Analysis

max time kernel
33s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 18:11

Sharing

Report Analysis Logs

General

Target

KRNLWRD/krnl.exe
Size

1.2MB
MD5

fb3a52d1045b1a0298668f2d77680306
SHA1

e16d5085977f1b895b7b2a046570b2da474add86
SHA256

8869c44219364f911548cb18da0cc6413b3277d3a8a8df18d0a521b558830d6e
SHA512

e19ce4c86ef8bf2ab25b4da67bf83acef5a8e688abfd3f96e8dec8169ce410c833df7685b6fb0b7489cf90ca51c56cd7264e8b2a94865aea5e5dacd4c5b7f44f
SSDEEP

12288:LMqP5hP0pwI7+G70EE/0GGGGGGhGGGGxdoM43nwVkokbtkK:LZEpRC4ysGGGGGGhGGGGx1Vpstz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3064	3012	krnl.exe	29
PID 3012 wrote to memory of 3064	3012	krnl.exe	29
PID 3012 wrote to memory of 3064	3012	krnl.exe	29
PID 3012 wrote to memory of 3064	3012	krnl.exe	29

C:\Users\Admin\AppData\Local\Temp\KRNLWRD\krnl.exe
"C:\Users\Admin\AppData\Local\Temp\KRNLWRD\krnl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 572
  2⤵
  - Program crash
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000F50000-0x0000000001086000-memory.dmp

Filesize
1.2MB

Download
memory/3012-2-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

Filesize
4KB

Download